PUA - DIT Snapshot Viewer Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•14

Detects the execution of 'ditsnap.exe', a tool used to inspect the Active Directory database (ntds.dit). This tool can be used by adversaries to dump credentials from a domain controller.